Glossary

150 terms from Security Monitoring and Automation, in plain words, each with the chapter that teaches it.

Search the glossary

A

agent: A program installed on a monitored machine that reads local logs, files and processes and sends what it finds to the SIEM. Examples are EDR agents, the Wazuh agent and the Splunk Universal Forwarder; the shop's rsyslog forwarder works the same way.
agentic: Describes an AI tool that acts on its own: given a goal, it plans steps, calls tools such as querying the SIEM or blocking an address, and decides the next step in a loop. Because it acts, it needs guardrails.
agentless: Collecting data without installing anything on the machine, using built-in features such as syslog, SNMP, flow export, SSH, cloud APIs or outside probes. It covers routers, printers and cloud services, but gives less detail and puts credentials on the collector.
AI (artificial intelligence): Software that does tasks that seem to need human judgment, such as summarizing alerts or spotting unusual traffic. Security teams use it as AI-augmented analysis, predictive models, chatbots and agentic tools.
AI-augmented: AI that helps a person analyze, for example by summarizing an alert or drafting a SIEM query, while the person still makes the decision.
alert: A message raised by a rule that asks a person, or automation, to act now, such as a sign-in as admin after 40 failures. Alerts push work to people, while dashboards wait to be looked at.
alert tuning: Changing rules so they raise fewer false positives without missing real attacks, by adjusting thresholds and windows, adding narrow exclusions, fixing causes or changing severity. Alex's tuning cut 172 weekly alerts down to the 2 real ones.
allow-list: A list of things that are explicitly permitted, with everything else refused. guardrail.py lets only listed actions such as query_siem and open_ticket run on their own.
anomaly detection: Learning what normal activity looks like (the baseline) and flagging anything that differs from it a lot. It needs no signature, so it can catch new attacks, but unusual isn't always bad.
Ansible: A free desired-state tool: you describe how a system should be in a YAML playbook, and Ansible changes only what differs. Alex uses it to keep the router's block list up to date.
API (application programming interface): A way for one program to ask another for data or actions. Agentless collection reads cloud email sign-in logs through the provider's API, and scripts open tickets through a ticket system's API.
auth.log: The Linux log file that records sign-ins and changes to administrator rights. It is an operating-system log source; on Windows the equivalent is the Security log.
Authentication-Results: An email header your own mail server adds on arrival, giving the results of its SPF, DKIM and DMARC checks. On Jo's fake invoice it showed spf=fail and dmarc=fail.
authPriv: The strongest of SNMPv3's three security levels: every message is checked with a password and the contents are encrypted. noAuthNoPriv does neither and authNoPriv checks but doesn't encrypt.
automation: A machine doing one task without a person, such as blocking an address. It brings speed, consistency and scale, but a bad rule also acts fast.
awk: A command-line tool that splits each line into fields and prints or processes them. In awk, `$NF` is the last field and `substr()` cuts out part of a text, as timeline.sh does to pick the HH:MM:SS time.

B

backdoor: A hidden way for an attacker to control a system. In model manipulation, an attacker might swap the real model file for a backdoored one.
baseline: The measured pattern of normal activity that new values are compared with, described by its mean and standard deviation. anomaly.py learns it from the first 20 windows, before the scraper arrives.
bias: When a model treats some groups unfairly because its training data was skewed. For example, a sign-in model trained mostly on US offices may flag every sign-in from abroad.
brute force: Guessing a password by trying many in a row until one works. The attacker at 203.0.113.66 signed in as admin after 40 failed guesses.

C

capture filter: A filter applied while recording packets, such as `tcp port 80`: packets that don't match are never saved. tcpdump uses capture filters, and so does tshark with `-f`.
capture group: A pair of round brackets in a regular expression that keeps the text it matched. parse.py uses one group per field, such as time, host and address.
certificate: A digital document a server uses to prove who it is. With syslog over TLS, the log server proves its identity with a certificate.
chatbot: An AI tool you talk to in plain language, such as a staff chat window where someone asks "is this email a scam?" A chatbot can be jailbroken or leak data that is pasted into it.
CI/CD (continuous integration and continuous delivery): A pipeline where a server automatically checks every change and delivers only the ones that pass. Alex's check.sh runs as security gates on every push to GitHub.
collector: The server that receives flow records from an exporter and stores them. In the lab it is nfcapd on siem, listening on UDP 2055; in agentless monitoring, the collector is the server that queries the devices.
combined log format: The line format most web servers use for their access logs: client address, time, request, status code, reply size, referring page and user agent. The shop's shop-access.log uses it.
community string: The shared password used by SNMP v1 and v2c, sent in plain text so anyone watching can read it. Alex's snmpd.conf has no community, so v2c requests get no answer.
correlation rule: A SIEM rule that links different events, within one source or across many. success.sql pairs each successful sign-in with 5 or more failures from the same address in the 10 minutes before it.
cron job: A command that Linux runs automatically on a schedule. On a real server, a cron job or systemd timer would run minisoc.sh every minute and keep running after restarts.
CSV (comma-separated values): A plain-text table format with one row per line and the values separated by commas. parse.py writes events.csv, which the SIEM then loads.
curl: A command-line tool that sends web requests and prints the replies, useful for testing web services and APIs. For example, `-d` sends form data such as a failed sign-in, and `-X POST` with a JSON body creates a record such as a ticket.
CVE (Common Vulnerabilities and Exposures): A public ID number for one known security flaw. EPSS scores how likely each CVE is to be exploited, and a hallucinating AI may make up a CVE number.

D

dashboard: One screen of panels, each answering one question at a glance with a number, short table or chart. dashboard.sh is a text version for the shop's sign-ins; dashboards wait for people to look, unlike alerts.
data loss: Sensitive data leaking out, for example when staff paste customer data or secrets into a public chatbot. Kettle & Crane allows only approved AI tools and no customer data in prompts.
deny by default: Refusing every action that isn't explicitly allowed. guardrail.py's last `else` refuses unknown actions such as delete_logs, because nobody can predict everything an agent might invent.
desired state: A written description of how a system should be, which a tool such as Ansible enforces by changing only what differs. Running it on a schedule fixes drift automatically.
detective control: A security control that notices attacks that got through, rather than stopping them. Security monitoring is a detective control.
display filter: A filter used while reading a capture in Wireshark or tshark (`-Y`). It hides packets that don't match and can name decoded fields such as `http.request.method == "POST"`.
DKIM (DomainKeys Identified Mail): An email check in which the sending domain signs its messages so the receiving server can verify them. The fake invoice carried no DKIM signature.
DMARC (Domain-based Message Authentication, Reporting and Conformance): An email check that confirms the visible From: domain matches a domain that passed SPF or DKIM, following that domain's published policy. It failed on the fake invoice because the From: domain was beansupply.example but the mail came from beansupp1y.example.
drift: Unplanned changes that move a system away from its desired state, such as a setting changed by hand that nobody remembers. Deleting the router's nft table by hand caused drift, which Ansible's next run repaired.

E

EDR (endpoint detection and response): Security software on a computer that watches for malicious activity and can respond, for example by killing a process or cutting the machine off the network. Alex puts EDR agents on the shop server and staff laptops.
Elastic Security: A SIEM product from Elastic. Like other SIEMs, it has its own query language.
email headers: The lines at the top of an email that record how it travelled and who claims to have sent it, such as Received:, From:, Return-Path: and Message-ID:. Reading them showed Jo's invoice came from a look-alike domain.
epoch time: A time written as the number of seconds since January 1, 1970, 00:00 UTC. It makes time arithmetic easy: two events 300 apart are 5 minutes apart.
EPSS (Exploit Prediction Scoring System): A public score of how likely each CVE is to be exploited within the next 30 days. It is an example of a predictive model.
evasion: An attacker shaping their own input so a detector misses it while the detector is in use, without touching the model. The low-and-slow guesser and malware padded until it scores clean are both evasion.
exit status: A number a command returns when it finishes: 0 means success and anything else means failure. `echo $?` shows it; curl's 28 means it timed out, and Ansible stores it as `rc`.
explainability: Whether you can tell why a model reached its answer. A rule like brute-tuned.sql explains itself, but a model that only says "risk 0.91" doesn't, so analysts can't check or tune it.
exporter: The device, usually a router or firewall, that builds flow records and sends them to a collector. In the lab it is pmacctd on gw. (The Prometheus blackbox exporter is a different kind of tool with a similar name.)

F

facility: The part of a syslog message that says what kind of program sent it, such as auth (4) for sign-ins or local0–local7 (16–23) for your own programs. Together with severity it makes the priority number.
false negative: A real attack that raised no alert. The low-and-slow guesser at 203.0.113.88 was a false negative for both short-window rules.
false positive: An alert for something harmless, such as the old sync script on Alex's laptop or Priya's typos. Too many false positives teach people to ignore alerts.
file metadata: Facts about a file. Some are kept by the file system (owner, size, times, shown by stat) and some are stored inside the document (a .docx's core.xml names its author and last editor, such as jbaker and Admin-PC7).
flow: A series of packets that share the same source and destination addresses, ports and protocol, such as one direction of a web download. Each connection appears as two flows, one per direction.
flow record: A one-line summary of a flow: who talked, which ports, how many packets and bytes, and when, with none of the contents. It is small enough to keep for months; the 2.4 MB export became one record of about 50 bytes.

G

grep: A command that finds the lines of text that match a pattern, used to search and count log entries. Useful options include `-c` to count matches, `-q` to print nothing and only set the exit status, `-o` to print only the matched text, and `-x -F` to match a whole line as plain text.
GROUP BY: The SQL clause that puts matching rows into groups and returns one result per group. brute.sql groups by address and `ts / 300` to count failures per address in each 5-minute block.
guardrail: A limit around an AI tool or automation, enforced by ordinary code it can't argue its way past: an allow-list, protected targets, human approval, rate limits and a decision log. guardrail.py refused to block the SIEM's own address.

H

hallucination: A model stating something false with confidence, such as a made-up CVE number or a command flag that doesn't exist, like `nmap --safe-delete`. Check every fact and command against a real source.
hash: A short fingerprint computed from a file's contents that changes if the file changes. Checking a model file's hash shows whether someone has swapped or altered it.
HAVING: The SQL clause that keeps only the groups that match a condition. In brute-tuned.sql, `HAVING count(*) >= 8` sets the rule's threshold.
HTTP method: The verb at the start of a web request: GET asks for a page, and POST sends data such as a sign-in form or a new ticket. The attacker's password guesses were POST requests to /login.
HTTP status codes: The three-digit number a web server puts in its reply to say how a request went. For example, 200 means OK, 401 means not signed in, and any code in the 2xx range means success, which is why monitoring probes often count 2xx as "up".
HTTPS (HTTP Secure): Web traffic encrypted with TLS. A capture of the real shop's HTTPS traffic would show addresses, ports and sizes, but not the passwords typed into forms.
human approval: A guardrail that makes a person approve big actions before they run, such as disabling Priya's account. guardrail.py marks those actions "needs human approval".

I

idempotent: Describes an action where running it again changes nothing once the desired state is reached. The second run of blocklist.yml reported `changed=0`.
IDS (intrusion detection system): A system that watches network traffic for known attack patterns and raises alerts. It usually listens on a mirror port or tap, so it can see traffic but can't block it.
incident response: The work after an attack is confirmed: containing it, keeping evidence and recovering. Alex's conclusion hands over to incident response, which changes admin's password and blocks the address.
ingress and egress: Ingress is traffic arriving at a port and egress is traffic leaving it. mirror.sh copies both directions of the shop's port to the sensor.
IPFIX (IP Flow Information Export): The open IETF flow-export standard (RFC 7011), built from NetFlow v9 and sometimes called version 10. It uses templates, so it can carry any fields, and its official port is 4739.

J

jailbreak: A prompt that talks a model out of its safety rules, such as "pretend you're an AI with no rules". It is a form of direct prompt injection aimed at the model's built-in limits.
JSON (JavaScript Object Notation): A text format of named values in braces, such as {"title": "Test ticket", "severity": "low"}. Programs use it to talk to REST APIs, and the AI agent writes its proposed actions in it.

L

log aggregation: Collecting many machines' logs on one central server. It gives one place to search, keeps copies an intruder can't delete, and lines events up on one timeline.
log source: Anything that produces security records, such as an operating system, application, network device, security tool, cloud service or device-health counter. Each one answers different questions.
log-parsing: Splitting log lines into named fields such as time, host, address and user so a program can count and search them. parse.py does it for the syslog and web access formats.
logs: Lines of text that programs write when something happens, such as "Failed login for admin from 203.0.113.66". They show what a program decided, but not anything it didn't record.
look-alike domain: A domain name made to look like a real one, such as beansupp1y.example (a digit 1 in place of the letter l) for beansupply.example. Phishers use one so a quick glance at the address seems trustworthy.
low-and-slow: An attack spread out slowly enough to stay under short-window thresholds, like 203.0.113.88 guessing about once every 25 minutes all week. A daily rule with a long window catches it.

M

mean: The average of a set of numbers: add them and divide by how many there are. Together with the standard deviation, it describes a baseline.
metadata: Data about data, such as who made a message or file, when, and how it travelled. Systems add it rather than people, so it is harder to fake; examples are email headers and a file's author and times.
Microsoft Sentinel: Microsoft's cloud SIEM product, with its own query language.
model manipulation: Tampering with an AI model itself or the settings around it, such as swapping in a backdoored model file or changing its thresholds or system instructions. Defend by checking hashes and limiting who can change settings.

N

NetFlow: Cisco's flow-export format. Version 5 has fixed fields and IPv4 only; version 9 added templates so new fields fit. Collectors usually listen on UDP 2055.
network management system (NMS): Software that polls every device by SNMP, receives traps, graphs the numbers, draws a network map and alerts on device health. It watches health and capacity, while a SIEM watches security events.
network tap: A small device spliced into a cable that copies all traffic passing through it to a monitoring port. Unlike a mirror port, it can't drop copies when busy, but it must be installed in the cable.
nfcapd: The flow collector used in the lab. On siem, it receives flow records on UDP 2055 and writes them to files in /tmp/kc/flows, starting a new file every 60 seconds.
nfdump: A command that reads stored flow files and answers questions about them. `-R` reads a folder, `-o "fmt:..."` picks the columns, and a filter such as `'bytes > 1000000'` keeps only matching flows.
normalization: Giving the same field the same name and format in every source, so one rule can search them all. For example, the web log's client address and the sign-in message's "from" both become `ip`, and every time becomes UTC.

O

OID (object identifier): The dotted number path that names one value in SNMP, such as 1.3.6.1.2.1.2.2.1.2 for interface names. Traps also use OIDs, such as the one for linkDown.
orchestration: Linking automated tasks across several tools into one workflow, for example an alert that makes a script check a threat feed, change the firewall and open a ticket.
oversubscription: When the source ports send more traffic than the mirror port can carry, such as two busy 1 Gbit/s ports mirrored to one 1 Gbit/s port, so some copies are dropped.

P

packet analyzer: A tool that decodes captured packets into readable fields such as addresses, ports, HTTP requests and form values. tcpdump, Wireshark and tshark are examples.
packet capture: A recording of whole packets, headers and contents, saved in a pcap file. It is the most detailed source but costs a lot of storage, holds private data, and can't see inside encrypted traffic.
pcap: The standard file format for saved packet captures, such as /tmp/kc/web.pcap. tcpdump writes it with `-w`, and tshark reads it with `-r`.
phishing: A fake message designed to trick someone, like the "overdue invoice" Jo received from beansupp1y.example, a look-alike of the real supplier's domain.
pivot: Taking an identifier from one result, such as an address, user or token, and searching for it in the next data source. Alex pivots on 203.0.113.66 from the logs to the flows and the packets.
playbook: In Ansible, a YAML file of named tasks that describes a desired state, like blocklist.yml. In SOAR, the steps a machine follows when an alert arrives (check, decide, act, record), like respond.sh.
poisoning: Corrupting the data a model learns from, before the model is used. Learning anomaly.py's baseline with the attack included raised the alert line from about 19 to about 90 requests.
polling: A manager asking a device for values on a schedule, every few minutes. SNMP polling is the opposite of traps, where the device sends a message the moment something happens.
port mirroring: Telling a switch to copy every frame entering or leaving chosen ports (or a VLAN) to one monitoring port where a sensor listens. A busy switch may silently drop copies.
predictive: Describes a model that forecasts from past data, such as Alex's straight-line trend showing the log disk fills by June, or EPSS scores. Treat predictions like weather forecasts: useful, but never proof.
priority: The number in angle brackets at the start of a syslog message, calculated as facility × 8 + severity. For example, <36> is auth (4) × 8 + warning (4).
prompt: The text given to an AI model: the developer's instructions plus whatever the user and the data add.
prompt injection: Smuggling instructions into a prompt so the model follows them instead of its own. It can be direct, typed into the chat, or indirect, hidden in data the AI reads later, like the user agent in ticket-poisoned.txt.

Q

queue (rsyslog): An rsyslog setting that holds messages in memory or on disk while the log server can't be reached and keeps retrying. Because of the queue, the shop's message arrived after siem restarted.

R

rate limit: A guardrail that allows only a few actions per run, so a runaway loop stops. guardrail.py allows at most 3 blocks per run.
Received:: An email header that each mail server adds at the top when it handles a message, recording who handed it over, who took it and when. Read them from the bottom up; the one your own server added is the most trustworthy.
regular expression: A pattern that describes text, used by grep and Python to find and pull apart lines. parse.py uses one pattern per log format.
REST API: A style of web API where a program sends requests over HTTP, often with JSON bodies, to create or read things. ticketd.py accepts a POST to /tickets and replies with the new ticket's ID.
retention policy: A rule for how long logs are kept, set by laws and company rules. Log aggregation makes one policy possible for all machines.
Return-Path and Reply-To: Email headers that say where bounces (Return-Path) and replies (Reply-To) go. Unlike the From: line, which anyone can type, these exposed the look-alike domain on Jo's invoice.
RFC 3164: The older syslog format, such as `<36>Nov 1 09:14:59 vm router: message`. It has no year, time zone or version, so times are hard to line up.
RFC 5424: The current syslog message format: priority, version, ISO 8601 time with zone, host, program, three optional fields and the message text. Prefer it over RFC 3164.
rsyslog: Ubuntu's syslog server and forwarder. In the lab it collects logs on siem and forwards the shop's logs there; `rsyslogd -N1` checks a configuration file for errors.

S

SecOps (security operations): The day-to-day work of running security: watching alerts, investigating and responding. At Kettle & Crane that is Alex, part time.
security gates: Automatic checks in a CI/CD pipeline that stop insecure changes. check.sh fails if the playbook is invalid or the brute-force rule stops catching the known attack.
security monitoring: Collecting records of what happens on your systems, looking at them, and acting when something looks wrong. It is detective work that starts from the questions you need answered.
severity: In syslog, the part of a message that says how serious it is, from 0 (emerg, most serious) to 7 (debug). Alerts and tickets also carry a severity, such as low, medium or high.
SIEM (security information and event management): The center of security monitoring: it collects, parses and stores logs, correlates events with rules, raises alerts and reports. Alex builds a tiny one from SQLite and SQL.
signature: A known pattern of an attack that a tool looks for. Anomaly detection needs no signature, so it can catch new attacks.
SNMP (Simple Network Management Protocol): A protocol for watching device health: a manager polls devices on UDP 161, and devices send traps to UDP 162. Use SNMPv3 with authPriv.
SNMPv3: The secure version of SNMP: a user name with a password check on every message, plus encryption at the authPriv level. v1 and v2c send a community string in plain text.
SOAR (security orchestration, automation and response): A platform that runs response playbooks automatically when alerts arrive: check the facts, decide, act and record. respond.sh is a tiny SOAR-style playbook.
SOC (security operations center): The team, or setup, that does security operations: watching alerts, investigating and responding. Alex's minisoc.sh chains logs, rules, a block and a ticket into a mini SOC.
SPAN (Switched Port Analyzer): Cisco's name for port mirroring.
SPF (Sender Policy Framework): An email check of whether the server that sent a message is allowed to send for the domain it claims. It failed on Jo's invoice.
Splunk Enterprise Security: A widely used commercial SIEM. Its Universal Forwarder is an agent that sends a machine's data to it.
spraying: Trying passwords against many different user names, rather than many passwords against one. On Friday, 203.0.113.77 sprayed 12 user names.
SQL (Structured Query Language): The most common language for asking a database questions. SELECT picks columns, FROM the table, WHERE filters rows, ORDER BY sorts and AS names a result; Alex's SIEM rules are written in it.
standard deviation: A number for how far values usually spread from the mean. For the shop's baseline it was 2.4 requests, so a window of 146 was 55 deviations out.
syslog: The standard format and protocol for log messages. Each message carries a facility and severity, and it travels over UDP 514, TCP 514 or TLS on 6514.

T

TCP (Transmission Control Protocol): A transport protocol that confirms delivery, so a sender notices when the server is gone. syslog over TCP port 514 doesn't lose messages silently the way UDP does.
tcpdump: The classic command-line packet capture tool and analyzer. `-i` picks the interface, `-w` writes a pcap file, `-r` reads one, `-A` prints contents as text, and a capture filter such as 'tcp port 80' limits what is saved.
threat feed: An outside source of information about known bad addresses or other threats, which a playbook can check before acting.
threshold rule: A rule that alerts when something happens too often in a time window. brute-tuned.sql alerts at 8 or more failed sign-ins from one address in 10 minutes.
ticket: A record of one piece of work in a tracking system, with a title, severity, details, owner and a status from open to closed. respond.sh opens one, such as KC-1002, through the ticket system's API.
timeline: Events from several sources merged in time order, every time in UTC. timeline.sh lines up log, flow and packet events for one address to the second.
TLS (Transport Layer Security): Encryption for a network connection, where the server also proves who it is with a certificate. syslog over TLS uses TCP port 6514 (RFC 5425); use it whenever logs cross a network you don't control.
token: A secret value a server hands out after a successful sign-in, which then works like a key. The attacker used the token from the admin sign-in to download /admin/export.
training data: The examples a model learns from. If it is poisoned or skewed, the model learns the wrong lesson.
trap: An SNMP message a device sends on its own to the manager's UDP port 162 the moment something happens, such as an interface going down.
true negative: No alert, and nothing was wrong: the rule correctly stayed quiet.
true positive: An alert for a real attack, such as the brute force from 203.0.113.66 on Tuesday night.
tshark: Wireshark's command-line version, easy to script. `-r` reads a capture, `-Y` applies a display filter, and `-T fields -e FIELD` prints only the named fields.

U

UDP (User Datagram Protocol): A transport protocol that sends without confirming delivery. syslog over UDP 514 can lose messages silently and is easy to fake; SNMP and flow export also use UDP.
UTC (Coordinated Universal Time): The world's reference clock, with no daylight saving changes; a Z after a time means UTC. Store and compare every time in UTC so events from different sources line up.

W

Wireshark: The free graphical packet analyzer most analysts use. It decodes captures into fields you can search with display filters.

Z

z-score: How many standard deviations a value sits from the mean: (value − mean) ÷ standard deviation. A common rule flags anything above 3 as an anomaly.